Privacy Policy
Last updated: 19 August 2026
This policy explains how Stream-Punk handles personal data when you visit this website, contact us, apply for a role, or use Stream-Punk Studio and related services. It also explains when we act as a controller and when we process campaign data on a customer's behalf.
1. Controller
Stream-Punk GmbH (haftungsbeschränkt)
Achleitenstraße 2a
82547 Eurasburg
Germany
Telephone: +49 176 5685 5687
Email: info@stream-punk.com
Website: www.stream-punk.com
2. Data Protection Officer
Dr David Ng
Achleitenstraße 2a
82547 Eurasburg
Germany
Telephone: +49 176 5685 5687
Email: david.ng@stream-punk.com
3. Our role for customer campaigns
Stream-Punk is the controller for data used to run our website and business, manage Studio accounts, secure the Services, communicate with customers and improve our products.
When a customer uses Studio to run a campaign and determines why and how participant data is used, that customer is normally the controller and Stream-Punk acts as its processor. The customer's privacy notice and our data processing agreement then govern that processing. If you participated in a customer's campaign, please contact the campaign organiser first about that campaign data; we will assist the customer in responding to valid requests.
4. Website delivery and security logs
Our website is delivered using Amazon Web Services infrastructure, including Amazon S3 and Amazon CloudFront. When a page or file is requested, technical data may be processed in server and security logs, including the IP address, requested URL, date and time, response status, referrer, browser and device information.
We process this information to deliver the website, maintain availability, diagnose faults and protect our systems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the reliable and secure operation of the website and the prevention and investigation of abuse.
5. Contact and business enquiries
If you contact us by form, email or telephone, we process the information you provide, such as your name, company, contact details, selected topic and message. We use it to respond, provide support and take steps requested before entering a contract. The legal bases are Article 6(1)(b) GDPR where the enquiry concerns a contract and Article 6(1)(f) GDPR for other business communications and support.
The checkbox on the contact form records that you have seen this policy; it is not consent to unrelated marketing.
Spam protection
When you submit the contact form, we load Google reCAPTCHA from www.recaptcha.net to distinguish legitimate requests from automated abuse. It may process the IP address and technical or interaction data and set the necessary _GRECAPTCHA cookie for risk analysis. reCAPTCHA is not loaded merely by opening the contact page.
The provider is Google Ireland Limited. We use reCAPTCHA on the basis of Article 6(1)(f) GDPR and, for access to information on your device, section 25(2) no. 2 TDDDG. Our legitimate interest is protecting the form and our systems from automated abuse. See Google's Privacy Policy and Terms.
6. Consent preference and optional Google Analytics
We use browser local storage under the key streamPunkAnalyticsConsent to remember whether you accepted or declined optional analytics. This preference is necessary to respect your choice on later visits and is not used to identify you. The legal basis is Article 6(1)(f) GDPR and section 25(2) no. 2 TDDDG.
Google Analytics 4, provided by Google Ireland Limited, is optional. The Analytics tag is not downloaded and no Analytics request is sent unless you select “Accept”. If accepted, Analytics may set first-party cookies including _ga and _ga_TD5506S9XP for up to 13 months to distinguish browsers and sessions. The default implementation may collect user and session statistics, page activity, approximate location, browser and device information, screen resolution and referring pages. We do not intentionally send names, email addresses or other directly identifying form data to Analytics.
Google states that IP addresses are used at collection time to derive approximate location and are discarded before Analytics logs the data. We configure advertising storage, advertising user data and advertising personalisation as denied, and disable Google Signals and advertising-personalisation signals.
The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw or change your choice at any time through “Cookie settings” in the footer. Withdrawal removes the Analytics cookies that this site can address and prevents Analytics from loading on later pages. It does not affect processing carried out before withdrawal. For further information, see Google's Privacy Policy and Analytics data-collection information.
7. Stream-Punk Studio accounts and service operation
When you or your organisation use Studio, we may process:
- account and organisation data, such as name, business email address, account identifiers, roles and permissions;
- authentication, access, security and audit information;
- customer requests, support conversations and contract or billing administration data;
- campaign configurations, connected-service identifiers and technical integration settings; and
- service usage, diagnostic, performance and error data.
We use this data to create and administer accounts, provide and secure the Services, support users, fulfil contracts, comply with legal obligations and improve reliability. The legal bases are Article 6(1)(b), 6(1)(c) and 6(1)(f) GDPR. Our legitimate interests include account administration, fraud prevention, product security, support and service improvement.
8. Connected platforms and campaign data
At a customer's direction, Studio can connect to social, streaming and other services. Depending on the campaign and platform, data may include platform user IDs, display names or usernames, profile links, posts, comments, chat messages, reactions, timestamps, campaign entries, selected winners or scores, and the connected account or channel identifiers needed to operate the integration.
We process this data to collect eligible campaign activity, operate interactive experiences, moderate or filter content as configured, calculate results and provide campaign reporting. The customer is responsible for selecting the campaign purpose, legal basis, eligibility rules and participant notice. Connected platforms remain responsible for their own processing under their terms and privacy policies.
9. Recruitment
If you apply for a role, we process the application and contact information you provide to assess your application and communicate with you. The legal bases are section 26 BDSG and Article 6(1)(b) GDPR. If an application is unsuccessful, we normally erase it after six months unless a longer period is required for a legal claim or you separately consent to a longer talent-pool period.
10. Recipients and service providers
Personal data is available only to people who need it for the relevant purpose. We may use vetted service providers for hosting, content delivery, authentication, email, support, security and analytics. These include Amazon Web Services for website and service infrastructure and Google for optional Analytics and contact-form spam protection. Connected platform providers receive or make data available when an authorised customer enables their integration.
We may also disclose data to professional advisers, authorities or courts where necessary to establish or defend legal claims, comply with law, or protect people and systems.
11. International transfers
Some providers or their subprocessors may process data outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision or on appropriate safeguards such as the European Commission's standard contractual clauses and supplementary measures. You may contact us for information about the safeguards relevant to a particular processing activity.
12. Retention
We keep personal data only for as long as needed for the purpose described above, to fulfil a contract, follow a customer's documented instructions, maintain security, resolve disputes and meet statutory record-keeping duties. Relevant criteria include the contract term, the customer's campaign settings, account status, ordinary backup cycles, configured Analytics retention and applicable limitation or tax and commercial-law periods.
Contact enquiries are removed when they are resolved and no longer needed, subject to legal retention or claims. Account and contract records are retained for the service relationship and any required statutory period.
For customer-controlled campaigns, the customer determines the ordinary retention period and must ensure that it remains necessary for a lawful purpose. We retain campaign data for as long as the customer requires it for the campaign and Services, subject to the applicable agreement, lawful retention duties and ordinary backup cycles. Customers may instruct us to export, delete or return that data.
If we introduce a general schedule for removing older campaign data, we will give affected customers reasonable advance notice and, where reasonably possible, an opportunity to export the data or request continued retention before deletion. Earlier deletion may still be required by law, security needs, connected-platform rules or the customer's instructions.
13. Your rights
Subject to the legal conditions, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), and object to processing based on legitimate interests (Article 21). You may withdraw consent at any time for the future. You also have the right to complain to a data-protection supervisory authority.
For processing for which Stream-Punk is the controller, contact us or our Data Protection Officer using the details above. For customer-controlled campaign data, contact the campaign organiser where possible.
14. Supervisory authority
Our competent supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany. The BayLDA provides an online complaint service.
15. Automated decisions
Stream-Punk does not make decisions about website visitors or Studio account holders based solely on automated processing that produce legal or similarly significant effects. Campaign mechanics such as filtering, scoring or winner selection may be automated according to rules configured by the customer, but the customer determines and is responsible for those rules.
16. Changes to this policy
We may update this policy when our Services, providers or legal obligations change. The date at the top identifies the current version. We will provide additional notice where a change materially affects how we use personal data.